< Home

Example for Configuring Remote MAC Address Mirroring

Remote MAC Address Mirroring Overview

In remote MAC address mirroring, an observing port is connected to a monitoring device through an intermediate network and forwards the packets with a specified MAC address to the monitoring device through the intermediate network.

Configuration Notes

  • You must dedicate observing ports for mirroring use and do not configure other services on them to prevent mirrored traffic and other service traffic from affecting each other. Do not configure any member port of an Eth-Trunk as an observing port. If you must do so, ensure that the bandwidth of service traffic on this port and the bandwidth occupied by the mirrored traffic do not exceed the bandwidth limit of the port.

  • If the mirroring function is deployed on many ports of a device, a great deal of internal forwarding bandwidth will be occupied, which affects the forwarding of other services. Additionally, if the mirrored port bandwidth is higher than the observing port bandwidth, for example, 1000 Mbit/s on a mirrored port and 100 Mbit/s on an observing port, the observing port will fail to forward all mirrored packets in a timely manner because of insufficient bandwidth, leading to packet loss.

  • MAC address mirroring applies only to inbound packets.

  • For the applicable products and versions of this configuration example, see Applicable product models and versions.

Networking Requirements

As shown in Figure 1, all the hosts of a company access the Internet through SwitchA and belong to VLAN 10. The monitoring device Server is connected to SwitchA through SwitchB.

Internet access traffic of the host with a MAC address 0001-0001-0001 needs to be remotely monitored through the Server.

Figure 1 Remote MAC address mirroring networking

Configuration Roadmap

  1. Create VLAN 10 on SwitchA and add the ports that connect SwitchA to hosts to VLAN 10 so that the hosts can communicate with SwitchA at Layer 2.
  2. Create VLAN 20 on SwitchB, disable MAC address learning in this VLAN, and add the ports that connect SwitchB to SwitchA and the Server to VLAN 20 so that SwitchB can communicate with SwitchA and the Server at Layer 2.
  3. Configure GE0/0/4 of SwitchA as a remote observing port to forward mirrored packets to VLAN 20.
  4. Configure MAC address mirroring in VLAN 10 to copy Internet access traffic of the host with a specified MAC address in VLAN 10 to the remote observing port.

Procedure

  1. Add ports to VLANs.

    # Create VLAN 10 on SwitchA and add GE0/0/1 through GE0/0/3 to VLAN 10.

    <HUAWEI> system-view
[HUAWEI] sysname Switch
[SwitchA] vlan batch 10
[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type access     //Set the link type of the host-side interface to access. The default link type of interfaces is not access.
[SwitchA-GigabitEthernet0/0/1] port default vlan 10
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] port link-type access     //Set the link type of the host-side interface to access. The default link type of interfaces is not access.
[SwitchA-GigabitEthernet0/0/2] port default vlan 10
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/3
[SwitchA-GigabitEthernet0/0/3] port link-type access     //Set the link type of the host-side interface to access. The default link type of interfaces is not access.
[SwitchA-GigabitEthernet0/0/3] port default vlan 10
[SwitchA-GigabitEthernet0/0/3] quit

    # Create VLAN 20 on SwitchB, disable MAC address learning in this VLAN, and add GE0/0/1 and GE0/0/4 to VLAN 20.

    Here, VLAN 20 is used for forwarding only mirrored packets. If VLAN 20 already exists and has learned MAC address entries, run the undo mac-address vlan vlan-id command in the system view to delete all MAC address entries in VLAN 20.

    <HUAWEI> system-view
[HUAWEI] sysname SwitchB
[SwitchB] vlan 20
[SwitchB-vlan20] mac-address learning disable     //Disable MAC address learning in this VLAN.
[SwitchB-vlan20] quit
[SwitchB] interface gigabitethernet 0/0/1
[SwitchB-GigabitEthernet0/0/1] port link-type access     //Set the link type of the interface on the monitoring device to access. The default link type of interfaces is not access.
[SwitchB-GigabitEthernet0/0/1] port default vlan 20
[SwitchB-GigabitEthernet0/0/1] quit
[SwitchB] interface gigabitethernet 0/0/4
[SwitchB-GigabitEthernet0/0/4] port link-type trunk
[SwitchB-GigabitEthernet0/0/4] port trunk allow-pass vlan 20     //Set the link type of the interface on the network side to trunk. The default link type of interfaces is not trunk.
[SwitchB-GigabitEthernet0/0/4] return

  2. Configure an observing port.

    # Configure GE0/0/4 of SwitchA as a remote observing port.

    [SwitchA] observe-port 1 interface gigabitethernet 0/0/4 vlan 20     //Configure GE0/0/4 as Layer 2 remote observing port 1, and add it to VLAN 20.

    After the configuration is complete, the observing port forwards mirrored packets to VLAN 20 removing the need to add the observing port to the VLAN.

  3. Configure MAC address mirroring.

    # On SwitchA, configure MAC address mirroring in VLAN 10 and copy the packets that are received by all the ports in VLAN 10 and contain a MAC address 0001-0001-0001 to the remote observing port.

    [SwitchA] vlan 10
[SwitchA-vlan10] mac-mirroring 0001-0001-0001 to observe-port 1 inbound     //Mirror incoming packets with the MAC address 0001-0001-0001 on all the interfaces in VLAN 10 to observing port 1.
[SwitchA-vlan10] return

  4. Verify the configuration.

    # Check the observing port configuration.

    <SwitchA> display observe-port
  ----------------------------------------------------------------------
  Index          : 1
  Untag-packet   : No
  Interface      : GigabitEthernet0/0/4
  Vlan           : 20
  ----------------------------------------------------------------------

    # Check the mirroring configuration.

    <Switch> display port-mirroring
  ----------------------------------------------------------------------
  Observe-port 1 : GigabitEthernet0/0/4
  ---------------------------------------------------------------------- 
  Mac-mirror:
  ----------------------------------------------------------------------
  Mirror-mac       Vlan    Direction     Observe-port
  ----------------------------------------------------------------------
  0001-0001-0001   10      Inbound       Observe-port 1
  ----------------------------------------------------------------------

Configuration Files

  • Configuration file of SwitchA

    #
sysname SwitchA
#
vlan batch 10
#
observe-port 1 interface GigabitEthernet0/0/4 vlan 20
#
vlan 10
 mac-mirroring 0001-0001-0001 to observe-port 1 inbound
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 10
#
return

  • Configuration file of SwitchB

    #
sysname SwitchB
#
vlan batch 20
#
vlan 20
 mac-address learning disable
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 20
#
interface GigabitEthernet0/0/4
 port link-type trunk
 port trunk allow-pass vlan 20
#
return

Applicable product models and versions

Product

Product Model

Software Version

S2700

S2700-52P-EI, S2700-52P-PWR-EI

V100R006C05

S2720-EI

V200R006C10, V200R009C00, V200R010C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S2750-EI

V200R005C00SPC300, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00

S3700

S3700-SI

V100R006C05

S3700-EI

V100R006C05

S3700-HI

V200R001C00

S5700

S5700-LI

V200R005C00SPC300, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00

S5700S-LI

V200R005C00SPC300, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00

S5710-X-LI

V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00

S5700-SI

V200R005C00

S5700-EI

V200R001(C00&C01), V200R002C00, V200R003C00, V200R005(C00&C01&C02&C03)

S5710-EI

V200R001C00, V200R002C00, V200R003C00, V200R005(C00&C02)

S5700-HI

V200R001(C00&C01), V200R002C00, V200R003C00, V200R005(C00SPC500&C01&C02)

S5710-HI

V200R003C00, V200R005(C00&C02&C03)

S5720-LI, S5720S-LI

V200R010C00, V200R011C00, V200R011C10, V200R012(C00&C20), V200R013C00, V200R019C00, V200R019C10

S5720-SI, S5720S-SI

V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S5720I-SI

V200R012C00, V200R013C00, V200R019C00, V200R019C10

S5730-SI

V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S5730S-EI

V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S5720-EI

V200R007C00, V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S5735-L, S5735S-L

V200R019C00, V200R019C10

S5735S-L-M

V200R019C00, V200R019C10

S5735-S, S5735S-S

V200R019C00, V200R019C10

S5700

S5735-S-I

V200R019C10

S5700

S5720-HI, S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S

V200R019C10

S5732-H

V200R019C10, V200R019C20

S6700

S6700-EI

V200R001(C00&C01), V200R002C00, V200R003C00, V200R005(C00&C01&C02)

S6720-LI, S6720S-LI

V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S6720-SI, S6720S-SI

V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S6720-EI

V200R008C00, V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S6720S-EI

V200R009C00, V200R010C00, V200R011C00, V200R011C10, V200R012C00, V200R013C00, V200R019C00, V200R019C10

S6700

S6720-HI, S6730-H, S6730S-H, S6730-S, S6730S-S

V200R019C10

S7700

S7703, S7706, S7712

V200R019C10

S7706 PoE

V200R019C10

S7703 PoE

V200R019C10

For details about software mappings, visit Hardware Query Tool and search for the desired product model.

Parent Topic: Typical Mirroring Configuration
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic